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TNTHE CLAIMS: 
1-31, (Cancelled) 

32. (Previously Amended) A method for database management and recovery, comprising: 

(a) collecting network communications usage information in real-time from a plurality of 
network devices utilizing a plurality of infonmation source modules; 

(b) filtering and aggregating the network communications usage information utilizing a plurality 
of gatherers, wherein the filtering and aggregating are based on a user-defmed configuration; 

(c) completing a plurality of data records from the filtered and aggregated network 
communications usage information utilizing a central event manager, the plurality of data 
records corresponding to network usage by a pl\irality of users; 

(d) storing the data records in a database; 

(e) continuously monitoring a state of the gatherers; 

(f) detecting a fault; and 

(g) utilizing the state of the gatherers and the stored data records to recover from the fault upon 
the detection thereof 

33. (Original) A method as recited in claim 32, wherein the data records are stored in the 
database at a user-specified interval. 

34. (Original) A method as recited in claim 32, and further comprising time stamping the 
stored data records. 

35. (Original) A method as recited in claim 34, and further comprising deleting the stored 
data records upon the cessation of a predetermined amount of time after the storage utilizing the 
timestamp. 

36. (Original) A method as recited in claim 32, and fiirthcr comprising caching the 
network communications usage information collected from \he network device utilizing the 
gatherers. 
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37. (Previously Amended) A computer program product for database management and 
recovery, comprising: 

(a) computer code for collecting neUvork communications usage information in real-time from a 
plurality of network devices utilizing a plurality of information source modules; 

(b) computer code for filtering and aggregating the network communications usage information 
utilizing a plurality of gatherers, wherein the fihering and aggregating are based on a user- 
defined configuration; 

(c) computer code for completing a plurality of data records from the filtered and aggregated 
network communications usage information utilizing a central event manager, the plurality of 
data records corresponding to network usage by a plurality of users; 

(d) computer code for storing the data records in a database; 

(e) computer code for continuously monitoring a state of the gatherers; 

(f) computer code for detecting a fault; and 

(g) computer code for utilizing the state of the gatherers and the stored data records to recover 
from the fault upon the detection thereof 

38. (Original) A computer program product as recited in claim 37, wherein the data 
records are stored in the database at a user-specified interval. 

39. (Original) A computer program product as recited in claim 37, and further comprising 
computer code for time stamping the stored data records. 

40. (Original) A computer program product as recited in claim 39, and fiirther comprising 
computer code for deleting the stored data records upon the cessation of a predetermined amount of 
time after the storage utilizing the timestamp. 

41. (Original) A computer program product as recited in ciaim 37, and fixrther comprising 
computer code for caching the network communications usage information collected from the 
network devices utilizing the gatherers. 
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42. (Previously Amended) A system for database management and recovery, comprising: 

(a) information source modules for collecting network communications usage information in 
real-time from a plurality of network devices; 

(b) gatherers coupled to the information source modules, the gatherers adapted for filtering and 
aggregating the network communications usage information, wherein the filtering and 
aggregating are based on a user-defined configuration; 

(c) a central event manager coupled lo the gatherers, the central event manager adapted for 
completing a plurality of data records from the filtered and aggregated network 
corrunimications usage information, the plurality of data records corresponding to network 
usage by a plurality of users; 

(d) a database coupled to the central event manager, the database adapted for storing the data 
records; 

(e) logic for continuously monitoring a state of the gatherers; 

(f) logic for detecting a fault; and 

(g) logic for utilizing the state of the gatherers and the stored data records to recover from the 
fault upon the detection thereof. 

43. (Original) A system as recited in claim 42, wherein the data records are stored in the 
database at a user-specified interval. 

44. (Original) A system as recited in clcdm 42, and further comprising computer code for 
time stamping the stored data records. 

45. (Original) A system as recited in claim 44, and further comprising computer code for 
deleting the stored data records upon the cessation of a predetermined amount of time after the 
storage utilizing the timestamp. 

46. (Original) A system as recited in claim 42, and further comprising computer code for 
caching the network communications usage information collected from the network devices utilizing 
the gatherers. 
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47. (Previously Amended) A method for database management and recovery, the method 
comprising: 

(a) collecting network commimications usage information in real-time from network devices at a 
plurality of layers utilizing multiple gatherers each including a plurality of information source 
modules each interfacing with one of the network devices and capable of communicating 
using a protocol specific to the network device coupled thereto, the network devices selected 
from the group consisting of routers, switches, firewalls, authentication servers, web hosts, 
proxy servers, netflow servers, databases, mail servers, RADIUS servers, and domain name 
servers, the gatherers being positioned on a segment of the network on which the network 
devices coupled thereto are positioned for minimizing an impact of the gatherers on the 
network; 

(b) translating the network conunxmications usage information collected from the network 
devices utilizing the information source modules; 

(c) caching the network communications usage information collected from the network devices 
utilizing the gatherers; 

(d) normalizing the network connmunications usage information with the gatherers by excluding 
fields not required by a central event manager coupled to the gatherers; 

(e) defming an enhancement procedure utilizing the central event manager; 

(f) coordinating the collection of the network communications usage information by the 
gatherers utilizing the central event manager, 

(g) filtering the network communications usage information utilizing the central event manager, 

(h) completing a plurality of data records from the filtered network communications usage 
information, the plurality of data records corresponding to network usage by a plurality of 
users; 

(i) aggregating the network communications usage information and the data records utilizing the 
central event manager for reducing a number of the data records, wherein the filtering and 
aggregating are based on a user-defined configuration; 

(j) enhancing the aggregation with ihe gatherers in accordance with the defined enhancement 
procedure; 

(k) time stamping the data records at a user-specified interval; 
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(l) Storing the time stamped data records in tables in a central database coupled to the central 

event manager at a user-specified interval; 
(m) deleting the stored data records upon the cessation of a predetermined amount of time after 

the storage utilizing the timestamp; 
(n) continuously monitoring a state of the gatherers; 
(o) detecting a fault; and 

(p) utilizing the state of the gatherers and the stored data records to recover from the fault i^n 
the detection thereof 
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